Function read_frame 

pub async fn read_frame<R>(
    reader: &mut R,
    max_body: u32,
    budget: &mut Budget,
) -> Result<Incoming, WireError>
where
    R: AsyncRead + Unpin,

Read one frame, refusing an illegal length before allocating for it.

max_body is the caller’s ceiling for THIS frame, which is how the hello’s tighter 64 KiB cap is applied without a second codec: the handshake passes HELLO_MAX_BYTES and every frame after it passes FRAME_BODY_MAX_BYTES. A value above the protocol maximum is clamped rather than trusted.